CVE-2026-75689

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-48361

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-75744 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

CVE-2026-75689

Adobe Connect is impacted by a stored Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this by injecting malicious scripts into vulnerable form fields . When a victim navigates to the page containing these fields, the malicious JavaScript may execute in their browser, potential...

EUVD-2026-84782

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-48361

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can abuse this flaw to inject malicious scripts into vulnerable form fields . When a victim browses to the page containing the affected field, the malicious JavaScript may be executed in their bro...

CVE-2026-48361 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-75697 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

EUVD-2026-84779

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2021-46362

CVE-2021-46362：Magnolia CMS 中的 FreeMarker 服务端模板注入 Magnolia v6.2.3 及更低版本的注册和忘记密码表单中存在一个服务端模板注入（SSTI）漏洞，允许未经身份验证的攻击者通过在 fullname 参数中输入特制的 payload 来执行任意代码。 协作： 此漏洞是与 Marian-Razvan Ilisanu 合作发现的。 供应商披露： 供应商对此漏洞的披露和修复可参见此处。 概念验证： 更多详情及利用过程可参阅此 PDF。...

crawlergo

crawlergo Un potente rastreador de navegadores para escáneres de vulnerabilidades web Documento en inglés | 中文文档 crawlergo es un rastreador de navegadores que utiliza el modo chrome headless para la recolección de URLs. Engancha posiciones clave de toda la página web en la etapa de renderizado de...

X-Recon

一个用于识别网页输入并执行XSS扫描的工具。 功能特性： 子域名发现： 检索目标网站的相关子域名并将其整合到白名单中。这些子域名可在爬取过程中使用。 站点范围链接发现： 基于提供的白名单和指定的 maxdepth，收集网站中的所有链接。 表单与输入提取： 识别所有在提取的链接中找到的表单和输入，并生成 JSON 输出。该 JSON 输出为利用工具的 XSS 扫描能力奠定了基础。 XSS 扫描： 一旦初始侦察选项返回包含提取条目的自定义 JSON，X-Recon 工具即可启动 XSS 漏洞测试过程，并向您提供所需结果！ 注意： 扫描功能目前在...

Logsensor

Logsensor 一个强大的传感器工具，用于发现登录面板和POST表单SQL注入扫描 功能 多主机登录面板扫描 代理兼容性（http、https） 登录面板扫描采用多进程处理 因此该脚本在扫描多个URL时速度极快 快速教程和截图在底部展示 项目贡献提示在底部 安装 root@kitploit: git clone https://github.com/Mr-Robert0/Logsensor.git cd Logsensor && sudo chmod +x logsensor.py install.sh pip install -r requirements.txt...

CVE-2026-PoCs

CVE-2026-PoCs 一个由社区策划、验证的概念验证漏洞利用集合，涵盖2026年披露的CVE。 为什么有这个仓库 大多数CVE PoC集合分散在Twitter帖子、gist和失效的博客链接中。本仓库旨在成为2026年CVE PoC的单一、组织良好、积极维护的索引——包含一致的元数据、验证的参考来源以及清晰的贡献标准。 索引 CVE ID | CVE 描述| 受影响产品| 添加日期| POC 状态 ---|---|---|---|--- CVE-2026-9082| Drupal Drupal 核心中存在对 SQL 命令中特殊元素的不当处理（'SQL 注入'）漏洞，允许 SQL...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Contact Form 7 的多文件拖放上传插件 描述： 通过 drag‑and‑drop‑multiple‑file‑upload‑contact‑form‑7 ≤1.3.8.9 版本可实现任意文件上传，允许上传 .phar 文件，从而在 Apache+modphp 环境下导致远程代码执行 :contentReferenceoaicite:29index=29。 CVSS（v3.1）： 8.1（高危）:contentReferenceoaicite:30index=30 补丁： 更新至 ≥1.3.9.0 版本...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

moodle-login-csrf

此仓库包含用于发现和利用两个Moodle漏洞（MSA-18-0020 CVE-2018-16854 和 MSA-19-0004 CVE-2019-3847）的文件，这些漏洞利用了用户向其个人仪表板添加JavaScript的能力。MSA-18-0020依赖于登录表单上的CSRF，而MSA-19-0004则需要管理员模拟用户。 更多详情可在这篇博文中找到。 已修复的Moodle版本 MSA-18-0020 CVE-2018-16854: 3.6, 3.5.3, 3.4.6, 3.3.9, 和 3.1.15. MSA-19-0004 CVE-2019-3847: 3.6.3, 3.5.5,...

CVE-2026-5118

Divi Form Builder ⚠️ ADVERTENCIA: Esta herramienta es solo para pruebas de penetración autorizadas e investigación de seguridad. El acceso no autorizado a sistemas informáticos es ilegal. Úsela solo en sistemas que posea o para los que tenga permiso explícito por escrito para realizar pruebas. Más...

CVE-2026-13355

CVE-2026-13355 — Escalada de privilegios a administrador sin autenticación en Meta Box AIO Prueba de concepto en Python 3: escáner y exploit para CVE-2026-13355 en el paquete de WordPress Meta Box AIO y las extensiones relacionadas MB Frontend Submission / MB User Profile. | ---|--- Plataforma|...